CVE Intelligence
Home / Threat actors / Cobalt Group

Cobalt Group G0080

🔔 Create alert

Also known as: GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

5
associated CVEs
40
Techniques
6
Malware and tools

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2018-8174 High · 7.5 KEV Ransomware Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-8759 High · 7.8 KEV Microsoft .NET Framework Remote Code Execution Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-8570 High · 7.8 KEV Microsoft Office Remote Code Execution Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

Techniques by tactic

Resource Development
T1588.002 Tool
Initial Access
T1195.002 Compromise Software Supply ChainT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistence
T1037.001 Logon Script (Windows)T1053.005 Scheduled TaskT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1037.001 Logon Script (Windows)T1053.005 Scheduled TaskT1055 Process InjectionT1068 Exploitation for Privilege EscalationT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Stealth
T1027.010 Command ObfuscationT1055 Process InjectionT1070.004 File DeletionT1218.003 CMSTPT1218.008 OdbcconfT1218.010 Regsvr32T1220 XSL Script Processing
Discovery
T1046 Network Service DiscoveryT1518.001 Security Software Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol
Command and Control
T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool TransferT1219 Remote Access ToolsT1572 Protocol TunnelingT1573.002 Asymmetric Cryptography

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.